Last updated: June 2026 — Compliant with Act 25 (Quebec) & PIPEDA (Canada)
1. Introduction
Boost Review (hereinafter “we,” “our,” or “the Service Provider”), a trade name operated by a sole proprietorship with its principal place of business at 5059 Rue de Brébeuf, Montreal (Quebec) H2J 3L6, Canada, is committed to protecting the personal information of individuals who visit the boost-review.ca website or use its services.
This policy explains what information we collect, why we collect it, how we use it, and what your rights are with respect to that information, in accordance with Act 25 (Act to Modernize Legislative Provisions Concerning the Protection of Personal Information, Quebec, L.Q. 2021, c. 25) and the Personal Information Protection and Electronic Documents Act (PIPEDA), a Canadian federal law.
2. Data Controller
Privacy Officer:
Boost Review
, 5059 Rue de Brébeuf, Montreal, Quebec H2J 3L6
Email: aurelien@boost-review.ca
Any requests regarding your personal information should be directed to this person.
Bill 25 requires that a person be formally designated as the privacy officer. As a sole proprietor, that person is you. You must publicly disclose your title and contact information.
3. Information Collected
We collect only the information necessary for the purposes described in this policy (principle of data minimization). The following are the categories of data we collect:
DATA CATEGORY SOURCE
Contact Information Last name, first name, email, phone number, company name Demo booking forms (Calendly / Go High Level)
Browsing Data IP address, pages visited, session duration, traffic source, device used Google Analytics 4, Google Tag Manager
Sales Data Communication history, prospect/customer status, follow-up notes Go High Level (CRM)
Billing Data Payment information (processed and stored exclusively by Stripe) Stripe
We do not collect sensitive information as defined by Act 25 (ethnic origin, health, sex life, religious or political beliefs, etc.).
4. Purposes of Data Processing
The information collected is used exclusively for the following purposes:
— Managing demo requests: scheduling appointments, confirming appointments, and following up after the demo.
— Customer Relationship Management: tracking prospects, onboarding customers, and providing customer support.
— Contract fulfillment: subscription activation and management, billing, and cancellation.
— Web analytics: analysis of visitor behavior on the site to improve its performance (via GA4).
— Marketing communications: sending information about our services, only with your prior consent or as part of an existing business relationship.
We do not use your information for automated profiling that produces legal effects or significantly affects you.
5. Shelf Life
CATEGORY RETENTION PERIOD
Prospect data (non-converted) 24 months after the last contact
Active customer data Subscription period + 36 months (accounting and legal requirements)
Browsing data (GA4) 14 months (recommended GA4 setting), followed by anonymized aggregation
CRM data (Go High Level) 24 months after the end of the business relationship
Billing data (Stripe) In accordance with Stripe’s policy and Canadian tax requirements (7 years)
Once these time limits have expired, the data is deleted or permanently anonymized.
6. Sharing with Third Parties
We never sell, rent, or share your personal information with third parties for commercial purposes.
Your data may be shared with the following third-party service providers, only to the extent necessary to provide the service:
SUBCONTRACTOR ROLE LOCATION
Stripe Payment processing United States
Calendly Demo scheduling United States
Go High Level CRM and sales tracking United States
Google (GA4 / GTM) Audience analytics United States
Hostinger Website hosting Cyprus / EU
These subcontractors are bound by contractual confidentiality and security obligations. Some are located outside Canada; the transfer of your data abroad is governed in accordance with Section 17 of Act 25 (privacy impact assessment, PIA, or equivalent contractual safeguards).
Act 25, Section 17: Any transfer of data outside Quebec requires a prior assessment of the level of protection provided by the recipient country. Your four U.S. processors (Stripe, Calendly, GHL, Google) are all covered by standard contractual clauses or recognized certifications. Keep a written record of this assessment in your internal files—if the CAI (Commission d’accès à l’information) ever conducts an audit, you must be able to produce it.
7. Cookies
Our website uses cookies. A cookie is a small text file that is stored on your device when you visit the site.
COOKIE NAME ISSUER PURPOSE DURATION
_ga, _ga_* Google Analytics 4 Audience measurement, navigation analysis 2 years
GTM Cookies Google Tag Manager Tracking tag management Session
In accordance with Law 25, non-essential cookies are only stored after we have obtained your explicit consent via our cookie management banner. You can withdraw your consent at any time from that same banner or from your browser settings.
8. Safety
We implement appropriate technical and organizational measures to protect your personal information from unauthorized access, disclosure, alteration, or destruction, including:
— Secure HTTPS connection throughout the site;
— Access to the tools is restricted to authorized personnel only;
— We do not store any banking data on our own servers (we outsource this entirely to Stripe).
In the event of a privacy incident that could cause serious harm, we are committed to notifying the Quebec Access to Information Commission (CAI) and the individuals concerned within the timeframes set forth in Act 25.
9. Your Rights
In accordance with Act 25 and PIPEDA, you have the following rights:
RIGHT DESCRIPTION
Access Obtain a copy of the information we hold about you
Rectification Have inaccurate or incomplete information corrected
Erasure Request the deletion of your data, subject to legal retention obligations
Portability Receive your data in a structured, commonly used, and machine-readable format
Withdrawal of Consent Withdraw your consent to processing at any time, without retroactive effect
De-indexing Request that the dissemination of information about you be discontinued under certain conditions
To exercise these rights, please send your request by email to: aurelien@boost-review.ca
Response time: 30 days from the date we receive your request.
If you believe that the processing of your data does not comply with applicable law, you may file a complaint with the Commission d’accès à l’information du Québec (CAI): www.cai.gouv.qc.ca
10. Policy Update
We reserve the right to modify this policy at any time to reflect changes in laws, regulations, or operations. The date of the last update is indicated at the top of the document. In the event of a substantial change, we will notify you by email or through a prominent notice on the website.
